Edit report at https://bugs.php.net/bug.php?id=74429&edit=1
ID: 74429
Comment by: boen dot robot at gmail dot com
Reported by: martijn dot grendelman at isaac dot nl
Summary: Remote socket URI with unique persistence identifier
broken
Status: Closed
Type: Bug
Package: Streams related
Operating System: Any
PHP Version: 7.0.18RC1
Assigned To: pollita
Block user comment: N
Private report: N
New Comment:
Hello.
I'm the user who posted the user doc note (after accidently finding it when developing https://github.com/pear2/Net_Transmitter)
So... This is now "fixed" how? Is the after slash ID once again a thing for now, until a
documented replacement is in place?
Abyway, as far as a replacement goes, I'd personally be perfectly fine with
tcp://ip:port/id=bla AND breaking BC (since this was an undocumented feature/hack...).
Libraries like credis, predis and Net_Transmitter can easily be amended to prefix "id="
before the actual ID, which would work in all past versions where this undocumented feature/hack was
working AND will work with that option introduced.
And BTW, if the PHP site allowed users to amend their user contributed doc notes, I totally would.
Meanwhile, I hope you only nuke it after this feature gets properly introduced OR amend it to
include a link to this bug report.
Previous Comments:
------------------------------------------------------------------------
[2017-04-28 17:50:50] pollita@php.net
I need to sit down later and collate all the myriad places bad transport strings get created (both
intentionally and unintentionally) and I'll start a thread on internals to that effect.
I'll be happy to cc you at the time to make sure you see it. :D
------------------------------------------------------------------------
[2017-04-28 09:43:57] dominic at varspool dot com
Thanks for the patch ab! Further discussion of the future of this undocumented hack (as it has
rightly been called), and any possible replacement (maybe a stream context option?) will, I presume,
take place on the mailing list?
I'd recommend nuking the user note at http://php.net/manual/en/function.stream-socket-client.php#105393
to limit the spread of the problem, in any case, though.
------------------------------------------------------------------------
[2017-04-25 12:11:32] ab@php.net
The fix for this bug has been committed.
Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.
For Windows:
http://windows.php.net/snapshots/
Thank you for the report, and for helping us make PHP better.
------------------------------------------------------------------------
[2017-04-21 13:19:11] requinix@php.net
Related To: Bug #74486
------------------------------------------------------------------------
[2017-04-18 21:40:44] pollita@php.net
For what it's worth, https://gist.github.com/sgolemon/51f329655a94523546f081bf9c9afd31
is probably safe enough to use as it would still cover the security case given by bug #74216, it
would allow colinmollenhour's hack to keep working, and it's fairly "URI-ish",
so it's not an unreasonable looking thing.
I'm not personally convinced though.
------------------------------------------------------------------------
The remainder of the comments for this report are too long. To view
the rest of the comments, please view the bug report online at
https://bugs.php.net/bug.php?id=74429
--
Edit this bug report at https://bugs.php.net/bug.php?id=74429&edit=1